LiteLLM has SQL Injection in Proxy API key verification
Affected range
ECOSYSTEM: introduced 1.81.16; fixed 1.83.7Fixed versions: 1.83.7
litellm
Library to easily interface with LLM API providers
PyPI latest 1.101.0 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
1.101.0
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Critical
41 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback
Affected range
ECOSYSTEM: introduced 0; fixed 1.84.0Fixed versions: 1.84.0
LiteLLM: Authenticated command execution via MCP stdio test endpoints
Affected range
ECOSYSTEM: introduced 1.74.2; fixed 1.83.7Fixed versions: 1.83.7
GHSA-6wvf-77m9-58rm critical
LiteLLM vulnerable to server-side template injection in the /prompts/test endpoint
Affected range
ECOSYSTEM: introduced 0; fixed 1.83.7Fixed versions: 1.83.7
GHSA-4xpc-pv4p-pm3w critical
LiteLLM: Authentication Bypass via Host Header Injection
Affected range
ECOSYSTEM: introduced 0; fixed 1.84.0Fixed versions: 1.84.0
GHSA-jjhc-v7c2-5hh6 critical
LiteLLM: Authentication bypass via OIDC userinfo cache key collision
Affected range
ECOSYSTEM: introduced 0; fixed 1.83.0Fixed versions: 1.83.0
GHSA-gppg-gqw8-wh9g critical
litellm vulnerable to remote code execution based on using eval unsafely
Affected range
ECOSYSTEM: introduced 0; fixed 1.40.16Fixed versions: 1.40.16
GHSA-46cm-pfwv-cgf8 critical
LiteLLM has Server-Side Template Injection vulnerability in /completions endpoint
Affected range
ECOSYSTEM: introduced 0; fixed 1.34.42Fixed versions: 1.34.42
GHSA-5mg7-485q-xm76 critical
Two LiteLLM versions published containing credential harvesting malware
Affected range
ECOSYSTEM: introduced 1.82.7; last affected 1.82.8 GHSA-4jcj-7x88-m979 high
LiteLLM: MCP Proxy Has Improper Authentication
Affected range
ECOSYSTEM: introduced 0; fixed 1.84.0Fixed versions: 1.84.0
GHSA-j37q-q7p9-vpwm high
LiteLLM: SSO Debug Flow Has Improper Authentication
Affected range
ECOSYSTEM: introduced 0; last affected 1.82.2 GHSA-wxxx-gvqv-xp7p high
LiteLLM has a sandbox escape in custom-code guardrail
Affected range
ECOSYSTEM: introduced 1.81.8; fixed 1.83.10Fixed versions: 1.83.10
GHSA-qrc4-49gv-mv9m high
LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit
Affected range
ECOSYSTEM: introduced 0; fixed 1.83.14Fixed versions: 1.83.14
GHSA-g26j-5385-hhw3 high
LiteLLM Server-Side Request Forgery (SSRF) vulnerability
Affected range
ECOSYSTEM: introduced 0; fixed 1.44.8Fixed versions: 1.44.8
GHSA-wpfp-gwwc-vwq6 high
LiteLLM allows a user to modify their own user_role via the /user/update endpoint
Affected range
ECOSYSTEM: introduced 0; fixed 1.83.10Fixed versions: 1.83.10
GHSA-xqmj-j6mv-4862 high
LiteLLM: Server-Side Template Injection in /prompts/test endpoint
Affected range
ECOSYSTEM: introduced 1.80.5; fixed 1.83.7Fixed versions: 1.83.7
GHSA-69x8-hrgq-fjj8 high
LiteLLM: Password hash exposure and pass-the-hash authentication bypass
Affected range
ECOSYSTEM: introduced 0; fixed 1.83.0Fixed versions: 1.83.0
GHSA-53mr-6c8q-9789 high
LiteLLM: Privilege escalation via unrestricted proxy configuration endpoint
Affected range
ECOSYSTEM: introduced 0; fixed 1.83.0Fixed versions: 1.83.0
GHSA-879v-fggm-vxw2 high
LiteLLM Has a Leakage of Langfuse API Keys
Affected range
ECOSYSTEM: introduced 0; last affected 1.52.1 GHSA-fh2c-86xm-pm2x high
LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request
Affected range
ECOSYSTEM: introduced 0; fixed 1.56.2Fixed versions: 1.56.2
GHSA-7ggm-4rjg-594w high
litellm passes untrusted data to `eval` function without sanitization
Affected range
ECOSYSTEM: introduced 0; last affected 1.28.11 GHSA-g5pg-73fc-hjwq high
LiteLLM Reveals Portion of API Key via a Logging File
Affected range
ECOSYSTEM: introduced 0; fixed 1.44.12Fixed versions: 1.44.12
GHSA-fjcf-3j3r-78rp high
LiteLLM Has an Improper Authorization Vulnerability
Affected range
ECOSYSTEM: introduced 0; fixed 1.61.15Fixed versions: 1.61.15
GHSA-gw2q-qw9j-rgv7 high
LiteLLM Vulnerable to Denial of Service (DoS)
Affected range
ECOSYSTEM: introduced 0; fixed 1.53.1.dev1Fixed versions: 1.53.1.dev1
GHSA-53gh-p8jc-7rg8 high
LiteLLM Vulnerable to Remote Code Execution (RCE)
Affected range
ECOSYSTEM: introduced 1.40.3.dev2; last affected 1.40.12Show 16 more advisories
GHSA-3xr8-qfvj-9p9j Arbitrary file deletion in litellm
GHSA-hx8v-g79f-8w5f LiteLLM Proxy has server-side request forgery via the `user_config` request parameter
GHSA-p897-vf7j-f5h8 BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
GHSA-m2v5-74w2-qhcj BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
GHSA-c693-x898-5g4h BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
GHSA-w2mh-qq9q-453x BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
GHSA-6qr3-3g89-m4jj LiteLLM: Admin Key Handler Has Improper Authorization
GHSA-qmf3-4767-5fg3 LiteLLM: M2M JWT Handler Has Improper Authorization
GHSA-mf52-j94g-746m LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
GHSA-5jmr-gcrj-2c9q LiteLLM: Arbitrary file write via path traversal in Skills archive extraction
GHSA-qqcv-vg9f-5rr3 litellm vulnerable to improper access control in team management
GHSA-h6m6-jj8v-94jj SQL injection in litellm
GHSA-8j42-pcfm-3467 SQL injection in litellm
GHSA-72m8-9m7m-h278 LiteLLM: Custom Code Guardrails production endpoints bypass code safety checks
GHSA-4g5m-c9r5-49xf LiteLLM: Local file read via request-supplied OIDC file references
MAL-2026-2144 Malicious code in litellm (PyPI)